From 3dfc49e57865b576028123102a4dcf7bee6fba89 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 12:12:51 +0200 Subject: [PATCH] =?UTF-8?q?docs(samba):=20Explorer=20human=20leg=20PASSED?= =?UTF-8?q?=20=E2=80=94=20R-7=20slice=201=20fully=20PROVEN-LIVE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Viktor confirmed on the demo box: Network -> FELHOM -> both shares open; an INTERACTIVE Explorer save into dokumentumok succeeded and landed owned 1000:1000 (force user holds for a real Explorer write, not just a scripted one); a write into the read-only filmek was refused by Windows with the folder left empty on disk. Capability-map row flipped to PROVEN-LIVE in felhom.eu. --- CHANGELOG.md | 4 +++- CONTEXT.md | 5 +++-- REPORT.md | 10 +++++++--- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a7e5f8c..5826b11 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,7 +59,9 @@ verdict), its config is a generated share list, and its roots ride the backup cl + `:ro` bind verified on the box → Windows 11 workstation: `Test-NetConnection 445` True, nbtstat `FELHOM <00>/<03>/<20> Registered`, `ping FELHOM` resolves, SMB write/read byte-compare PASS, and a **write to the read-only share refused with no effect**. SMB-written files land as `1000:1000`. - Explorer render is Viktor's remaining human leg. + **Explorer leg PASSED (Viktor, 2026-07-18):** both shares open from the Network view; an + interactive Explorer save landed owned 1000:1000 and a write into the read-only share was refused, + folder left empty. Slice 1 is fully PROVEN-LIVE. ### Build infra — build root relocated (2026-07-18) diff --git a/CONTEXT.md b/CONTEXT.md index a52cbb2..9db0139 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -30,8 +30,9 @@ Last updated: 2026-07-18 (v0.144.0 — „Megosztás": LAN SMB file sharing, R-7 > shaped; teaching them about a share-only stack is a structural change, so it was reported as a design > fork rather than improvised (task STOP clause). Live-validated end-to-end through the real endpoints > + a Windows 11 workstation (445, NetBIOS `FELHOM` resolves, write/read byte-compare PASS, write to a -> read-only share REFUSED with no effect, SMB writes land as uid 1000). **Explorer render = Viktor's -> remaining human leg.** Also: samba is protected in CODE (`config.alwaysProtectedStacks`) because +> read-only share REFUSED with no effect, SMB writes land as uid 1000). **Explorer leg PASSED (Viktor): both +> shares open, an interactive Explorer save landed as uid 1000, a write into the read-only share was +> refused. Slice 1 fully PROVEN-LIVE.** Also: samba is protected in CODE (`config.alwaysProtectedStacks`) because > controller.yaml is golden-generated — a side effect is that `monitor.EffectiveProtected` does NOT > monitor samba liveness (deliberate: no false alarms while off; see REPORT §9). diff --git a/REPORT.md b/REPORT.md index 630cb9c..6bc4c5c 100644 --- a/REPORT.md +++ b/REPORT.md @@ -141,6 +141,7 @@ page) from inside guest 9201. No server logic skipped — only client rendering. | **Write-refused (read-only)** | write to `\\192.168.0.127\filmek` **rejected**; folder still empty on the box (non-effect proven) | | `force user` promise | SMB-written `r7.txt` owned **1000:1000** on the box | | WS-Discovery | ProbeMatch from `192.168.0.127` **PASS** | +| **Explorer (human, Viktor)** | both shares open from the Network view; interactive Explorer **save** landed owned `1000:1000`; write into the read-only share **refused**, folder still empty | #### Two real bugs caught by live validation (fixed + regression-tested) @@ -155,9 +156,12 @@ page) from inside guest 9201. No server logic skipped — only client rendering. ### 8. NOT yet live-validated -- **Explorer render — Viktor's human leg.** Network view shows `FELHOM`, double-click opens both - shares. Everything objective around it passed (ProbeMatch, 445, NetBIOS name resolution, by-name - mount), so this is UX confirmation, not a mechanism gate. Stack + both shares are live on the demo box. +- ~~Explorer render~~ — **PASSED 2026-07-18 (Viktor).** Network → FELHOM → both shares open. He went + further than the scripted leg: a real Explorer **save** into `dokumentumok` succeeded and landed on + the box owned **1000:1000** (so `force user` holds for an interactive Explorer write, not just a + scripted one), and a write into the read-only `filmek` was refused by Windows + ("Destination Folder Access Denied") with the folder left **empty** on disk. Slice 1 is fully + PROVEN-LIVE; the capability-map row is flipped. - **Share data in a real backup run** — blocked by the §4 design fork (classified, not executed). - **Symlink-escape guard on Linux** — unit test SKIPs on Windows (no privilege). - Drive-disconnect behaviour live (unit-tested only); multi-root share sets; SMB throughput/signing.